avh4 / avh4/binwrap

Critical severity vulnerability - json-schema

Open
#65 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
39
Forks
15
PR merge metrics
No merged PRs in 30d

Description

This package depends on request 2.88.0
https://github.com/avh4/binwrap/blob/main/package.json#L42

Which depends on form-data 2.3.3
https://github.com/request/request/blob/master/package.json#L36

Which depends on json-schema 0.2.3

json-schema 0.2.3 has a critical vulnerability:
https://github.com/advisories/GHSA-896r-f27r-55mw

It would be great if this dependecy could be changed.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with package.json at line 42 and trace the request 2.88.0, form-data 2.3.3, and json-schema 0.2.3 dependency chain described in the issue. Review GHSA-896r-f27r-55mw and confirm the dependency update removes the vulnerable json-schema version.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.